stealerium | 1d854d717ddb81b7553ca4b656abff486e9c9b88f00bb5c7c32439f0f0ec4a75

Analysis

max time kernel
78s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
02/04/2023, 19:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
tmp.exe
Size 2.3MB
Sample230402-ype13sbf2v
SHA256 1d854d717ddb81b7553ca4b656abff486e9c9b88f00bb5c7c32439f0f0ec4a75
MD5 d2829d67c58fbacd09f8d0a23451fc30
SHA1 273ecdd5b7dd155356acd6bc56e718cdf1ebb537
SHA512 a6965217bf6c2f583cd01cb2dfe8b13c4a6ac74d36a92a916ad6bc383aeac0b06d172217f545fb519e231bce738ab138da6c3bd6726037756d1be9fda5fa3900
SSDEEP 49152:JrZblZvo10fSJtySnq1xKa84rJDWBHUu5G060Q:JdHo2fUEo6tf9bu/60Q
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

stealerium stealer

Malware Config

Extracted

Family

stealerium

https://discord.com/api/webhooks/1083787486414770176/bRUby2Hc780n1rWbdH1JvR9FMQhXsGjeB4IDRJlA2ejLhOoyL0sbMZ8pBlrnhljoFEKB

Signatures

Stealerium
An open source info stealer written in C# first seen in May 2022.
stealer stealerium

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\Control Panel\International\Geo\Nation	RegAsm.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4088 set thread context of 1688	4088	tmp.exe	83

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.NET\Framework\v4.0.30319\	RegAsm.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
32	timeout.exe

Kills process with taskkill 1 IoCs

evasion

pid	Process
4332	taskkill.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1688	RegAsm.exe
Token: SeDebugPrivilege	4332	taskkill.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 4088 wrote to memory of 1688	4088	tmp.exe	83
PID 4088 wrote to memory of 1688	4088	tmp.exe	83
PID 4088 wrote to memory of 1688	4088	tmp.exe	83
PID 4088 wrote to memory of 1688	4088	tmp.exe	83
PID 4088 wrote to memory of 1688	4088	tmp.exe	83
PID 4088 wrote to memory of 1688	4088	tmp.exe	83
PID 4088 wrote to memory of 1688	4088	tmp.exe	83
PID 4088 wrote to memory of 1688	4088	tmp.exe	83
PID 1688 wrote to memory of 4584	1688	RegAsm.exe	84
PID 1688 wrote to memory of 4584	1688	RegAsm.exe	84
PID 1688 wrote to memory of 4584	1688	RegAsm.exe	84
PID 4584 wrote to memory of 212	4584	cmd.exe	86
PID 4584 wrote to memory of 212	4584	cmd.exe	86
PID 4584 wrote to memory of 212	4584	cmd.exe	86
PID 4584 wrote to memory of 4332	4584	cmd.exe	87
PID 4584 wrote to memory of 4332	4584	cmd.exe	87
PID 4584 wrote to memory of 4332	4584	cmd.exe	87
PID 4584 wrote to memory of 32	4584	cmd.exe	88
PID 4584 wrote to memory of 32	4584	cmd.exe	88
PID 4584 wrote to memory of 32	4584	cmd.exe	88

C:\Users\Admin\AppData\Local\Temp\tmp.exe
"C:\Users\Admin\AppData\Local\Temp\tmp.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4088
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  - Checks computer location settings
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1688
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /C C:\Users\Admin\AppData\Local\Temp\tmpB0F5.tmp.bat
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4584
  - - C:\Windows\SysWOW64\chcp.com
      chcp 65001
      4⤵
      PID:212
  - - C:\Windows\SysWOW64\taskkill.exe
      TaskKill /F /IM 1688
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:4332
  - - C:\Windows\SysWOW64\timeout.exe
      Timeout /T 2 /Nobreak
      4⤵
      Delays execution with timeout.exe
      PID:32

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Web Service

T1102

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

tmpB0F5.tmp.bat

Path C:\Users\Admin\AppData\Local\Temp\tmpB0F5.tmp.bat
Size 57B
SHA256 b9c219365fc763715e7455b62ec89262ed79837d402c46bc88140348f114c081
MD5 1b52011735138c697071cb3d0be534e6
SHA1 b646fcb632ca5fb2256f359490bac32af05b245a
SHA512 c68b475a6dc51976845d4f0570e6d744ff2e6d057b3549656e86c574e20bc572738a794f495a98c45e4fb0d8f7f3aa637e0560c81ff36a7debabc16a4b414217
MD5 SHA1 SHA512

Submit Download

memory/1688-134-0x0000000000400000-0x0000000000584000-memory.dmp

Download

memory/1688-136-0x0000000005340000-0x00000000053A6000-memory.dmp

Download

memory/1688-137-0x00000000052B0000-0x00000000052C0000-memory.dmp

Download

memory/4088-133-0x0000000000820000-0x0000000000A72000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads